[SOLVED] Update with Quotes

[elderclann]

I have a standard form using an <input> tag. I am entering quotes into this field and updating my database. When the text is updated into the data base the quotes hava a \ in front of them. I've tried double quotes, single quotes, inserting the \ and it always updates incorectly. Here is the php code I'm using to update the db any help is greatly appreciated.

 

<code>

 

$query = "Update tblEvents set eventDate = '" . $eventDate . "', eventTime = '" . $eventTime . "', eventTitle = '" . $eventTitle . "', eventLocation = '" . $eventLocation . "', eventDescription = '" . $eventDescription . "', showOnWeb = '" . $showOnWeb . "' where eventID = " . $eventID;

 

</code>

[revraz]

$query = "Update tblEvents set eventDate = '$eventDate', eventTime = '$eventTime', eventTitle = '$eventTitle', eventLocation = '$eventLocation', eventDescription = '$eventDescription', showOnWeb = '$showOnWeb' where eventID = $eventID;

 

 

[MadTechie]

The problem is likely due to Magic Quotes are being on

your need to use stripslashes, but that opens a security hole.. so try this

<?php
        if(get_magic_quotes_gpc()) {
            $eventDate = stripslashes($_POST['eventDate']);
            $eventTime= stripslashes($_POST['eventTime']);
            $eventTitle = stripslashes($_POST['eventTitle']);
            $eventLocation = stripslashes($_POST['eventLocation']);
            $eventDescription = stripslashes($_POST['eventDescription']);
            $showOnWeb = stripslashes($_POST['showOnWeb']);
            $eventID = stripslashes($_POST['eventID']);
        } else {
            $eventDate  = $_POST['eventDate'];
            $eventTime= $_POST['eventTime'];
            $eventTitle = $_POST['eventTitle'];
            $eventLocation = $_POST['eventLocation'];
            $eventDescription = $_POST['eventDescription'];
            $showOnWeb = $_POST['showOnWeb'];
            $eventID = $_POST['eventID'];
        }

$query = sprintf("Update tblEvents set eventDate = '%s', eventTime = '%s', eventTitle = '%s', eventLocation = '%s', eventDescription = '%s', showOnWeb = '%s' where eventID = %d",
mysql_real_escape_string($eventDate), 
mysql_real_escape_string($eventTime), 
mysql_real_escape_string($eventTitle),
mysql_real_escape_string($eventLocation),
mysql_real_escape_string($eventDescription),
mysql_real_escape_string($showOnWeb),
$eventID
);
?>